(1) The appropriate Government may, by notification in the Official Gazette, declare any computer resource which directly or indirectly affects the facility of Critical Information Infrastructure, to be a protected system.
Explanation.— For the purposes of this section, "Critical Information Infrastructure" means the computer resource, the incapacitation or destruction of which, shall have debilitating impact on national security, economy, public health or safety.
(2) The appropriate Government may, by order in writing, authorise the persons who are authorised to access protected systems notified under sub-section (1).
(3) Any person who secures access or attempts to secure access to a protected system in contravention of the provisions of this section shall be punished with imprisonment of either description for a term which may extend to ten years and shall also be liable to fine.
Legal Commentary & Landmark Judgments: Section 70
Section 70 of the Information Technology Act empowers the Government to declare any computer resource as 'Critical Information Infrastructure' (CII), while Section 70B designates CERT-In as the national agency for incident response and mandatory cyber reporting.
This statutory framework establishes clear operational guidelines, balancing legal compliance with procedural safeguards.
Protected systems under Section 70 encompass nuclear power plants, defense networks, air traffic control, power grids, and core banking backbones. Under CERT-In directions issued under Section 70B(6), failure to report ransomware attacks, data leaks, or unauthorized system access within six hours attracts criminal penalties and regulatory sanctions.